. Dans-la-première-partie, nous avions pour but de définir une liste d'exigences en sécurité qui permet d'analyser les trois solutions de sécurité les plus déployées, à savoir les protocoles SSL/TLS, IPSec et SSH. Ceci nous a permis de comparer ces protocoles et de pouvoir arborer d'une part

. Dans-la-deuxième-partie, nous nous somme intéressés à étendre le protocole SSL/TLS. Grâce à sa simplicité de déploiement, SSL/TLS est actuellement le protocole d'authentification et de sécurisation des échanges le plus déployé

S. La-première-modification-du-protocole and . Tls, Nous avons proposé de remplacer le protocole Handshake de SSL/TLS par le protocole de gestion des clés ISAKMP utilisé actuellement avec le protocole IPSec. L'intérêt de ce travail est de fournir, entre autres, l'unification des associations de sécurité et la mise en épreuve du protocole ISAKMP avec un nouveau protocole de sécurité

J. Arkko, R. Blomalle00, ]. J. Allen, A. Christie, W. Fithen et al., The MAP Security Domain of Interpretation for ISAKMP. IETF Internet Draft, draft-arkko-map-doi-05.txt State of Practice of Intrusion Detection Technologies, 2000.

G. Apostolopoulos, V. Peris, D. Saha, M. Badra, O. Sherkaoui et al., Transport Layer Security: How much does it really cost Pre-Shared-Key key Exchange methods for TLS, IETF Internet Draft, draft-badra-tls-key-exchange- 00, the Proceedings of the IEEE INFOCOM, 1999.

M. Badra, A. Serhrouchni, P. Urien, and . Express, IETF Internet Draft,draft- badra-tls-express-00.txt (work in progress) Redondance de sites et VPN SSL dans le cadre d'un réseau GPRS. Master's thesis, Département Informatique et réseaux From secrecy to authenticity in security protocols, Controlling digital multisignature with attribute certificate. Annual Computer Security Applications Conference 9th International Static Analysis Symposium (SAS'02), volume 2477 of Lecture Notes in Computer Science, pp.9-13, 2002.

L. Bozga, Y. Lakhnech, and M. Périn, Pattern-based abstraction for verifying secrecy in protocols, Tools and Agorithms for the Construction and Analysis of Sytems (TACAS'03), 2003.

L. Bozga, Y. Lakhnech, M. Périnblan01-]-b, and . Blanchet, An Efficient Cryptographic Protocol Verifier Based on Prolog Rules, the 14th IEEE Computer Security Foundations Workshop (CSFW'01), Cape BretonMMUSIC] Multiparty Multimedia Session Control (MMUSIC) Home Page, 2001.

B. Canvel, A. Hiltgen, S. Vaudenay, M. Vuagnouxcanet01, ]. R. Canetti et al., Password Interception in an SSL/TLS session. CRYPT'03 Analysis of Key-Exchange Protocols and Their Use for Building Secure Channels Security Analysis of IKE's Signature-based Key- Exchange Protocol, Coudol. Les contraintes imposes par le droit à la signature électronique. In the 3rd Conference on Security and Network Architectures, pp.583-599, 2001.

. Sécurité-des-réseaux, Analyse et mise en oeuvre Gouvernement du Canada, service CST, janvier 1996. [Cant01] A. Canteaut, F. Lévy-dit-Véhel. La cryptologie moderne, Paru dans la Revue Armemen, vol.73, pp.76-83, 2001.

G. Denker, J. Meseguer, and C. Talcott, Hellman. New directions in cryptography Vérification de protocoles de sécurité dans un modèle de l'intrus étendu, Mémoire de DEA. Laboratoire Spécification et Vérification Ecole Normale Supérieure de Cachan American National Standard for Information Systems-Data Link Encryption, Protocol specification and analysis in Maude November1976. [Dela03] S. Delaune La distribution de contenu dans l'Internet (CDN), cours magistral à l'ENSTDSS] NIST FIPS PUB 186. Digital Signature Standard. National Institute of Standards and Technology, U.S. Department of CommerceDbar02] D. Barrett, R. Silverman. SSH, le Shell sécurisé : la référence. N° ISBN, pp.644-654, 1983.

J. Demerjian and A. Serhrouchni, EPMI : Une extension de l'infrastructure de gestion des privilèges, IEEE International Conference Sciences of Electronic, Technology of Information and Telecommunications SETIT, pp.205-220, 2004.

D. Bolignano, F. Fiorenza, F. Jacquemard, D. Le-métayer, R. Eva et al., Pre-Shared Key Ciphersuites for Transport Layer Security (TLS) IETF Internet Draft, draft-eronen-tls-psk-00.txt Réseau National des Technologies Logicielles, Explication et Vérification Automatique de protocoles cryptographiques Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption Security Requirements for Cryptographic Modules, [Ferg00] N. Ferguson, B. Schneier. A cryptographic evaluation of IPSec, 2000.

J. Goubault-larrecq, A Method for Automatic Cryptographic Protocol Verification, International Workshop on Formal Methods for Parallel Programming, 2000.
DOI : 10.1007/3-540-45591-4_134

P. Gutmann and S. Tls, IETF Internet Draft, draft- ietf-tls-sharedkeys-02.txt [GNUTLS] The GNUTLS project, Use of Shared Keys in the TLS Protocol the proceedings the IEEE Global Communications conference (GLOBECOM'03), pp.1481-1485, 2003.

]. I. Hajj03b, A. Hajjeh, F. Serhrouchni, and . Tastet, New Key Management Protocol for SSL/TLS In the proceedings of the IEEE-IFIP Network Control and Engineering for QoS, Security and Mobility (NetCon'03), Muscat (Oman), vol.1, issue.19, pp.251-262, 2003.

I. Hajjeh, A. Serhrouchni, F. Tastet-dans-ssl-/-tlshajj03d, ]. I. Hajjeh, A. Serhrouchni et al., Sousse (Tunisie A new Perspective for ebusiness with SSL/TLS Une nouvelle perspective pour SSL/TLS avec ISAKMP. 2ème Rencontre francophone sur Sécurité et Architecture Réseaux Nancy (France) Integrating a signature module in SSL/TLS Génération d'une preuve de non répudiation dans SSL/TLS. 3ème Rencontre francophone sur Sécurité et La Londe, Cote d'Azur (France), the proceedings of the IEEE International Conference Sciences of Electronic the proceedings of the Fifth International Conference on Advances in Infrastructure for eBusiness, eEducation, eScience, on the Internet (SSGRR2003w). L'aquila (Italie) the proceedings of the First ACM/IEEE International Conference on E-Business and Telecommunication Networks, ICETE'04 . Setúbal (Portugal) Proceedings of the Annual USENIX Technical Conference Cryptanalyse et Sécurité des algorithmes à Clé Secrète Thèse de doctorat. Ecole Nationale Supérieure des Télécommunications, 1999. [Huss05] M. Hussain, I.Hajjeh, H. Afific et D. Sereta: «Tri-party IKEv2 in Home Networks». Soumis à la conférence ICC'2005, 40th annual IEEE International Conference on Communications Mai 2005. [Hoff02] P. Hoffman. Features of Proposed Successors to IKE. IETF Internet Draft, pp.56-55, 2000.

M. Thompson, D. Olson, R. Cowles, S. Mullen, M. Helm-harkins et al., CA-based Trust Issues for Grid Authentication and Identity Delegation, Grid Forge Document No. 17. [ibmVPN] Using IPsec to Construct Secure Virtual Private Networks. IBM Corporation, The Internet Key Exchange (IKE), 2004.

R. Projet, ]. J. Enst-parisjaco03, ]. K. Jacobsonjack01, S. Jackson, D. T. Tuecke et al., IP Sécurité : de la théorie à la pratique Mémoire de diplôme d'ingénieurs Trust negotiation in session-layer protocols Master of Science Negotiation of NAT- Traversal in the IKE, ISO/IEC 9798-2: Information technology ? Security techniques ? Entity authentication ? Part 2: Mechanisms using symmetric encipherment algorithms Blaze, R. Canetti, J. Ioannidis,A.D. Keromytis, and O. Reingold. Just Fast Keying (JFK). IETF Internet Draft (draft-ietf-ipsec-jfk- 00.txt), 1999.

H. Krawczyk, SIGMA: The ???SIGn-and-MAc??? Approach to Authenticated Diffie-Hellman and Its Use in the IKE Protocols, the proceedings of the 23rd Annual International Cryptology Conference (CRYPTO'03), 2003.
DOI : 10.1007/978-3-540-45146-4_24

V. Klima, O. Pokorny, T. Rosakols02-]-o, B. Kolesnikov, and . Hatch, Attacking RSA-based Sessions in SSL/TLS, http://eprint.iacr.org, Construire un VPN sous IP avec Linux. Edition CampussPressLlor03] C. Llorens, L. Levier. Tableaux de bord de la sécurité réseau. Edition Eyrolles. ISBN, pp.2-212, 2002.

G. Labouretlow98-]-g and . Lowe, IPSEC: Présentation technique Hervé Schauer Consultants (HSC) Casper: A compiler for the analysis of security protocols, the proceedings of the 10th Computer Security Foundations Workshop (CSFW'97, pp.53-84, 1997.

N. Modadugu, E. [. Rescorla, H. Millen, and . Rueß, The Design and Implementation of Datagram TLS Protocol-Independent secrecy, the 11th Annual Network and Distributed System Security Symposium the proceedings of the 21 st Symposium on Research in Security and Privacy, 2000.

A. Meddahi, K. Masmoudi, H. Afifi, A. M. Hamed, and I. Hajjeh, Enabling secure third party control on wireless home networks, 2004 4th Workshop on Applications and Services in Wireless Networks, 2004. ASWN 2004., 2004.
DOI : 10.1109/ASWN.2004.185154

L. Magazine and M. , Available at: http://www.win.tue.nl/~henkvt/PerfForwSec (Krawczyk).pdf [PKIX-WG] Groupe de travail Public-Key Infrastructure (X.509) (PKIX), IETF Analysis of the IPSec Key Exchange Standard, the proceedings of the 10th IEEE International Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises, WET ICE 2001. [Resc03] E. Rescorla, N. Modadugu, Datagram Transport Layer Security, IETF Internet draft, 2002.

E. Rescorla and T. Ssl, Designing and Building Secure System

P. Karn, W. Simpson, and R. Shirey, Photuris: Session-Key Management Protocol. IETF RFC No. 2521, RFC3275] Signature Syntax and Processing. W3C and IETF Sandard. IETF RFC No. 3275 PKCS#7: Cryptographic Message Syntax Version 1.5. IETF RFC No. 2315RFC3369] R. Housley. Cryptographic Message Syntax (CMS). IETF RFC No. 3369, 1998.
DOI : 10.17487/rfc2522

M. Myers, Internet X.509 Public Key Infrastructure: Online Certificate Status Protocol ? OCSP. IETF RFC No.2560, RFC2311] S. Dusse, P. Hoffman et al. S/MIME Version 2 Message Specification, 1998.

J. Reynolds, Assigned Number: RFC 1700 is Replaced by an On-line Database, IETF RFC No, vol.3232, 2002.
DOI : 10.17487/rfc3232

T. Dierks and C. Aallen, The TLS Protocol Version 1.0. IETF RFC No. 2246, 1999.

H. Schulzrinne, S. Casner, R. Frederick, and V. Jacobson, RTP: A Transport Protocol for Real-Time Applications, IETF RFC, issue.3550, 2003.
DOI : 10.17487/rfc3550

H. Krawczyk, M. Bellare, R. [. Canetti, S. Khare, and . Lawrence, HMAC: Keyed-Hashing for Message Authentication, IETF RFC No. 2104, Mockapetris. Domain Names -Concepts and Facilities, 1987.

P. Mockapetris, Domain Names -Implementation and Specification, 1987.
DOI : 10.17487/rfc1035

URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.375.9285

M. Wahl, A. Coulbeck, T. Howes, S. Kille, S. Kille et al., Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions. IETF RFC No. 2252, Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names. IETF RFC No. 2253RFC2460] S. Deering and R. Hinden. Internet Protocol, 1997.
DOI : 10.17487/rfc2251

P. Karn and W. Simpson, Photuris: Session-Key Management Protocol, 1999.
DOI : 10.17487/rfc2522

R. Rivest, The MD5 Message Digest Algorithm, IETF RFC No. 1321, 1992.

J. Postel and J. Reynolds, The Internet IP Security Domain of Interpretation for ISAKMP. IETF RFC No. 2407, RFC2406] S. Kent, and R. Atkinson. IP Encapsulating Security Payload (ESP). IETF RFC No. 2406, 1993.

J. Khol and C. Neuman, The Kerberos network authentication service (v.5)
DOI : 10.17487/rfc1510

D. Harkins, The Internet Key Exchange (IKE) IETF RFC No. 2409 The Group Domain of Interpretation, IETF RFC, issue.3547, 1997.
DOI : 10.17487/rfc2409

M. Leech, M. Ganis, Y. Lee, R. Kuris, D. Koblas et al., Hypertext Transfer Protocol -- HTTP/1.0. IETF RFC No A method for obtaining digital signatures and public-key cryptosystems [RSA03] Factorization of RSA-576, TR13.pdf [SAML] Security Assertions Markup Language, Verisign, pp.120-126, 1928.

]. T. Ssh-arch, T. Ylonen, M. Kivinen, T. Saarinen, S. Rinne et al., SSH protocol architecture. IETF Internet Draft, draft-ietf-secsh-architecture-13.txt, 2002.

]. T. Ssh-auth, T. Ylonen, M. Kivinen, T. Saarinen, S. Rinne et al., SSH authentication protocol. IETF Internet Draft, draft-ietf-secsh-userauth-18.txt SSH transport layer protocol. IETF Internet Draft, draft-ietf-secsh-transport-17.txt, Saarinen, T. Rinne, and S. Lehtinen. SSH connection protocol. IETF Internet Draft, 2002.

J. Snell, D. Tidwell, P. Kulchenkoshac02-]-h, D. Shacham, . Bonehshac01-]-h et al., Programming Web Services with SOAP Fast-Track Session Establishment for TLS Improving SSL Handshake Performance via Batching, the Proceedings of Internet Society's Proceedings of RSA Narayana Jayaram Migration of Internet Security Protocols to the IPSEC framework. In the Proceedings of the 36th IEEE Carnahan Conference on Security Technology, 2001.

. Sigma-]-h, . Krawczyk, I. The, and . Protocol, Available at: http://www.ee.technion.ac.il/~hugo/draft-krawczyk-ipsec-ike-sigma-00.txt [Stunnel] The STUNNEL Projet, www.stunnel.org [SHA] NIST FIPS PUB 180-1. Secure Hash Standard. Nationa Institute of Standards and Technology, U.S. Department of Commerce Progress, 1994.

R. Bruce-schneier-spring, D. Mahajan, . W. Wetherallstrei02-]-w, R. K. Streilein, S. E. Cunningham et al., Measuring ISP topologies with rocketfuel Improved Detection of Low-Profile Probe and Novel Denial-of Service Attacks Client Side Caching for TLS, Applied Cryptography : Protocols, Algorithms, and Source Code in C Proceedings of ACM SIGCOMM'2002 the proceedings of the Workshop on Statistical and Machine Learning Techniques in Computer Intrusion Detection the Proceedings of Internet Society's 2002 Symosium on Network and Distributed System Security (NDSS)Stal02] W. Stallings. Sécurité des réseaux, Applications et standard, Editions Vuibert Informatique, pp.195-202, 1995.

D. Samfat-de-doctorat, M. Paris, A. Shérif, and . Serhrouchni, Architecture de sécurité pour réseaux mobiles, Thèse, 1996.

D. Taylor, T. Wu, T. Perrintsch03-]-h, H. Tschofenig, and . Schulzrinne, Using SRP for TLS Authentication, IETF Internet Draft, draft-ietf-tls-srp-06 RSVP Domain of Interpretation for ISAKMP, IETF Internet Draft, draft-tschofenig-rsvp-doi-01.txt, 1998.

G. R. Wright, W. R. Stevens, . Tcp, and . Ip-illustrated, Wireless Transport Layer Security Specification Version 1, Forum, vol.2, issue.12, p.11, 1994.

F. Wadjinny, Contexte d'utilisation des certificats d'attributs, 2002.

M. Wichert and D. Ingham, Non-repudiation Evidence Generation for CORBA using XML Analyse of the SSL 3.0 protocol, the proceedings of the ACSACs conference DTD, Version 2.1. Retrieved from, 1996.

[. Song, D. Wagner, and X. Tian, Timing Analysis of Keystrokes and Timing Attacks on SSH, 10th USENIX Security Symposium The SSH (Secure Shell) Remote Login Protocol, 1995.

N. Na, Pb: number // clé publique DH éphémère G: number // groupe DH négocié Kas: key // clé générée par l\'échange DH A knows, Kas { 1. A -> B : Na 2. B -> A : Nb 3. A -> B : Pa, G 4. B -> A : Pb

B. Ana, . Nb, . Pa, G. Pb, and . A=a, {S1}_Kas } s. session* {Kas B=B assume secret (SK(B)@s.B), secret(Kas@s.A), secret(Kas@s

A. Knows, A. , S. (. Ks, B. , B. Ca et al., Xb}_(SK(A))^alg}_Ks 6. B -> A : Ci,Cr, {{B,certB,Nr,Ni,p,g,Xa,Xb}_(SK(B))^alg}_Ks } s. session* {Ci secret (SK(A)@s.A), secret(Ks@s.A), secret(Ks@s Ks GoodPatterns: {xs}_PK(h); {xs}_Ks BadPatterns: vide enum { warning(1), fatal(2), (255) } AlarmLevel; enum { Service not supported(0) } AlarmDescription; struct { SessionID session AlarmLevel level AlarmDescription description, Secrets: SK(h) Negociation failure Invalid Version(3), Record_overflow Unexpected KE Syntax Expired Certificate(9), Revoked Certificate Bad _Certificate Unknown Certificate Authority(12), Invalid Cert Authority(13), Authentication Failed Bad_Mac(15), Invalid Signature Invalid Key Enctyption(17), Invalid Authentication Expired Session(20) Close_notify(22), p.Insuffisient_security

=. Protocolversion-version, /. {1, and . Prf, SHA-1(handshake_messages)) [0..11]; // negocition_succeed_label witll take the value " server_ng_succeed " if this message is sent by the server and " mediator_ng_succeed " if the message is send from the mediator, p.5

X. Représentation-en, <. Dtd-de-la-base-de-donnée-dbp>-<table-name=>, and . Dtdschema, DataBase Policy) <database name="politique_sep.mdb"> <table name=Authentication" /> <table name=Connection_Trace" /> <table name=

<. Type and C. , text" Size CDATA "50

<. Attlist-desciption-type and C. , text" Size CDATA "50

<. Authentication, table (Authentication)+ > <!ELEMENT Authentication (id_authentication

<. Attlist-authentication_name-type and C. , text" Size CDATA "50

<. Attlist-authentication_type-type and C. , text" Size CDATA "50

<. Attlist and C. Type, text" Size CDATA "50

<. Element-id_application, #PCDATA) > ATTLIST id_application Type CDATA "number" Size CDATA

<. Connection_trace, table (Connection_Trace)+ >

<. Attlist and C. Type, text" Size CDATA "50

<. Attlist and C. Type, text" Size CDATA "50

<. Attlist and C. Type, text" Size CDATA "50

<. Attlist and C. Type, text" Size CDATA "50

<. Attlist-data_in-type and C. , text" Size CDATA "536870910

<. Attlist and C. Type, text" Size CDATA "536870910

<. Mediator, table (Mediator)+ > <!ELEMENT Mediator (id_ia, ia_name, ip_address

<. Attlist-ia_name-type and C. , text" Size CDATA "50

<. Attlist and C. Type, text" Size CDATA "50

<. Attlist-delegated_certificate-type and C. , text" Size CDATA "536870910

<. Attlist-ip_source-type and C. , text" Size CDATA "50

<. Element-ip_destination, #PCDATA) > ATTLIST ip_destination Type CDATA "text" Size CDATA "50

<. Attlist-por_source-type and C. , text" Size CDATA "50

<. Attlist-port_destination-type and C. , text" Size CDATA "50

<. Element-id_application, #PCDATA) > ATTLIST id_application Type CDATA "number" Size CDATA

<. Security_parameters, table (Security_Parameters)+ > <!ELEMENT Security_Parameters (id_security_parameter, cipher_list, value

<. Attlist and C. Type, text" Size CDATA "50

<. Attlist and C. Type, text" Size CDATA "50

<. Server, table (Server)+ > <!ELEMENT Server (id_server, Server_name, ip_address, id_ia) >

<. Attlist-server_name-type and C. , text" Size CDATA "50

<. Attlist and C. Type, text" Size CDATA "50

<. Service, table (Service)+ > <!ELEMENT Service (id_service, service_name, used_port, id_Server

<. Attlist-service_name-type and C. , text" Size CDATA "50

<. Service_alarm, table (Service_Alarm)+ > <!ELEMENT Service_Alarm (id_service_alram, id_alarm, id_service) >

<. Service_authentication, table (Service_Authentication)+ > <!ELEMENT Service_Authentication (id_Service_Authentication, id_service, id_authentication, max_list) >

<. Service_parameters, table (Service_Parameters)+ > <!ELEMENT Service_Parameters (id_Service_Parameters, id_service, id_Security_Parameter, max_list) >

. Co and . Marilyne, Maknavicius de la chapitre sécurité du livre "IPv6 : Théorie et pratique

I. Hajjeh, A. Serhrouchni, and R. Naja, Fourniture d'un service de non répudiation avec SSL/TLS pour le commerce électronique. A paraitre dans " l'Annales des Télécommunications

P. Eronen, Pre-Shared Key Ciphersuites for Transport Layer Security (TLS), IETF Internet Draft, draft-ietf-tls-psk-04, 2004.

I. Hajjeh, A. Serhrouchni, M. Badra, and O. Cherkaoui, TLS-SIGN, IETF Internet Draft, draft-hajjeh-tls-sign-00.txt, 2005.

M. Badra, O. Cherkaoui, I. Hajjeh, and A. Serhrouchni, Pre-Shared-Key key Exchange methods for TLS. IETF Internet Draft, draft-badra-tls-key-exchange-00.txt (work in progress), 2004.

I. Hajjeh, M. Badra, and A. Serhrouchni, Building a Secure and Extensible Protocol for wired and wirless environments, VTC'2005 Spring, 61 st Vehicular Technology Conference Spring 2005 Wireless Access, 2005.

M. Hussain, I. Hajjeh, H. Afific, and D. Sereta, Tri-party IKEv2 in Home Networks, IEEE ICACT'2005, 7th International Conference on Advanced Communication Technology, 2005.

I. Hajjeh and A. Serhrouchni, Integrating a signature module in SSL/TLS, First International Conference on E-Business and Telecommunication Networks " . Setúbal (Portugal), 2004.

K. Meddahi, H. Masmoudi, A. M. Afifi, I. Hamed, and . Hajjeh, Enabling secure third party control on wireless home networks, 2004 4th Workshop on Applications and Services in Wireless Networks, 2004. ASWN 2004., 2004.
DOI : 10.1109/ASWN.2004.185154

I. Hajjeh, A. Serhrouchni, and F. Tastet, Vers l'intégration de nouveaux services dans SSL/TLS, International Conference Sciences of Electronic, p.52, 2003.

I. Hajjeh, A. Serhrouchni, and F. Tastet, A new Perspective for ebusiness with SSL/TLS, Fifth International Conference on Advances in Infrastructure for eBusiness, eEducation, eScience, on the Internet " . L'aquila (Italy), pp.84-56, 2003.

I. Hajjeh and A. Serhrouchni, Génération d'une preuve de non répudiation dans SSL/TLS SAR'2004, 3ème Rencontre francophone sur Sécurité et Architecture Réseaux, Juin, pp.21-25, 2004.

I. Hajjeh, A. Serhrouchni, and F. Tastet, Une nouvelle perspective pour SSL/TLS avec ISAKMP, SAR'2003, 2ème Rencontre francophone sur Sécurité et Architecture Réseaux " . Nancy (France), pp.55-63, 2003.